What has your team already put on the open internet?

What the scan does

• Searches public web results for apps published on the platforms below.
• Looks up your public DNS records and certificate transparency logs for subdomains pointing at those platforms.
• Reads your own public website for links to them.
• Opens each candidate page once, the way any visitor would, and records the address, the page title and the platform fingerprint.

What it does not do

• No logging in. The scan never enters a password, never uses a cookie or an API key, and never follows a redirect into a login page.
• No probing. It does not guess file names, try admin paths, or look for a way in.
• No content. Page text, screenshots and anything that looks like personal data are never stored.
• No pressure to prove anything to see the numbers, and no addresses handed to anyone who has not proved they work at the company being scanned.

What you get

• A summary at a private link straight away: how many apps were found and which platforms they are on, with the date each one first appeared.
• If your address is at the domain you entered, a link to the full report goes to your mailbox: every address found, the risk score and the reasons written out. Opening that link is what proves the mailbox is yours.
• Scanning a company you do not work at is fine. You see the summary, and you can send the full report to someone there. The addresses go to them, not to you.
• Anything wrong gets one click to dismiss, so the list you keep is a list you trust.
• Links work for 14 days. Findings from a scan without an account are deleted after 30 days.